Version 2.0 · Effective 1 October 2026
Controller: Mana Technology AB, org. nr 559449-7637, Grankottevägen 47, 181 47 Lidingö, Sweden Contact: legal@getmana.app · support@getmana.app · getmana.app
This policy explains how Mana handles personal data on the Mana platform (the "Platform"). It covers studios and other businesses that use the Platform ("Customers"), individuals who book and train through it ("Users"), and visitors to our sites. Our consumer marketplace at studiomaps.app (the "Marketplace") has its own privacy policy.
Mana is an independent controller for: your Mana Account and everything in it ("Mana Account Data"), our websites and analytics, our own marketing, and the Marketplace.
Mana is a processor for a Customer's own operational records — the bookings, memberships, payments and messages at that studio. The studio is the controller there, our Mana Data Processing Agreement governs it, and requests about those records go to the studio.
As controller we collect: your name and contact details, profile and preferences; login and security data; your social connections and friend lists; your interactions with other users; your booking and attendance history across every studio you use, plus the statistics and other data we derive from it; marketing preferences and consent records; technical and usage data from our sites and apps; your messages to our support team; identification and ownership data required for anti-money-laundering checks on Customers; and business information about studios collected from public sources for Marketplace listings. Where such listings contain personal data, such as a sole trader's name, we inform the individuals through this policy and the Studiomaps privacy policy rather than individually, because individual notice would require disproportionate effort (Art. 14(5)(b)).
The data marked as required when you register or book is needed to give you an account and to complete a purchase; without it we cannot provide the Platform. Everything else is optional. A studio may also register you at its reception; we then email you so you can activate your Mana Account and accept the Mana User Terms.
We do not ask you for health data. If a studio records health information about you, it does so as controller under its own privacy notice.
| Purpose | Legal basis |
|---|---|
| Creating and running your Mana Account; delivering bookings, purchases and the Platform to you | Contract, Art. 6(1)(b) |
| Social and sharing features — friends, shared bookings, training activity — and your cross-studio history and statistics | Contract; consent where a feature asks for it |
| Keeping the Platform secure and preventing fraud, abuse and payment risk | Legitimate interest, Art. 6(1)(f) |
| Improving the Platform and producing aggregated insights | Legitimate interest |
| Operating the Marketplace, including listings built from public sources | Legitimate interest |
| Keeping a one-way hash of a deleted account's contact details to enforce the deletion and keep banned accounts out | Legitimate interest |
| Marketing to Users | Consent, Art. 6(1)(a) |
| Service and product communications to Customers | Legitimate interest |
| Bookkeeping, tax, anti-money-laundering and responding to authorities | Legal obligation, Art. 6(1)(c) |
You can object to any processing based on legitimate interest, and withdraw consent at any time without affecting what we did before. Aggregated data no longer identifies anyone and falls outside this policy.
Every User has one Mana Account, independent of any studio. Mana Account Data — your profile, your friends and other social connections, your interactions with other users, your booking history and statistics across all studios, and everything we derive from these — is controlled by Mana.
Studios never receive, export, extract or copy Mana Account Data. A studio sees and can export only its own records about you: what you booked, bought and paid at that studio. Your history elsewhere, your friend list and your social activity stay with us. We hold that line because this data is also about other studios and other users.
We may contact you directly about your account and the Platform. Marketing to you happens only with your consent.
People you connect with see what the feature you used shows them. Nothing else about you is published on the Marketplace. We do not sell personal data.
We keep processing inside the EU/EEA wherever we can. Where a provider processes data outside it, we rely on EU Standard Contractual Clauses or a European Commission adequacy decision. Ask legal@getmana.app for the detail on a specific transfer.
You have the right to access your data, correct it, have it erased, restrict or object to processing, receive it in a portable format, object to direct marketing at any time, and withdraw consent. Email legal@getmana.app. We answer within one month, and tell you if a complex request needs up to two months more.
If your request concerns a studio's own records about you, ask the studio — we assist them as their processor.
You can complain to Integritetsskyddsmyndigheten (IMY), imy.se, or to the supervisory authority where you live.
We protect personal data with encryption in transit and at rest, access controls, monitoring, incident response and staff training. If a breach is likely to put you at high risk, we will tell you.
You must be 13, or the higher age set by the law of your country, to hold a Mana Account. Under 18, any purchase that creates a payment obligation needs a parent's or guardian's consent under the national rules on minors' capacity to contract. Studios may set a higher age. Where a studio runs children's classes, the studio is the controller for the child's data and we process it on the studio's instructions.
We do not make decisions with legal or similarly significant effects by automated means alone. Fraud and risk scoring is automated, but a person decides on payment holds and account suspensions.
See the Mana Cookie Policy.
We may update this policy. Material changes are notified by email or in the Platform at least 30 days before they take effect.